At the Login Window
For logging into your Mac, the login window will ultimately look the same and be ready for you to enter your username and password, ie - your eServices information. There is no longer any option for password hints, though accounts created from Active Directory never had them previously, so this is a change that will largely be unnotived.
...
At this time, the only users who will need to go through Duo Multi Factor Authentication will be those who have been granted VPN access to their campus owned Mac desktop. Due to how macOS does not discriminate between local and remote logins, those who utilize VPN access to their campus Mac desktop will have to go through Duo at every login.
Unlocking your active session
Up until now, TouchID has been able to be configured only during the initial login. After discussion and verification of how it works, TouchID will be fully functional to setup during the initial login and also able to be configured in System Preferences. For more information on TouchID, you can read further at this link.
...